The European Parliament on Thursday voted on a new regulation that will require airlines to provide national authorities with passenger data for all flights into and out of the European Union.
"We have adopted an important new tool for fighting terrorists and traffickers," stated the European Parliament's representative for the proposal, Timothy Kirkhope. "By collecting, sharing and analyzing [passenger name record] PNR information our intelligence agencies can detect patterns of suspicious behavior to be followed up."
The new directive was approved by a vote of 461 in favor to 179 against, with 9 abstentions. It comes in the wake of a series of terrorist incidents in Europe, including the Nov. 13 terror attacks in Paris that killed 129 people and the March 22 attacks in Brussels that killed 32 people.
Added Kirkhope, "There were understandable concerns about the collection and storage of people's data, but I believe that the directive puts in place data safeguards, as well as proving that the law is proportionate to the risks we face. EU governments must now get on with implementing this agreement."
The directive applies to flights into and out of the EU, but member states could also extend it to flights within the EU as long as the European Commission is properly notified. EU countries may also choose to collect and process PNR data from travel agencies and tour operators, since they also manage flight bookings.
Once EU member states have put systems into place to manage the data collection, the information will be retained for a period of five years. After six months, it will be stripped down, with elements such as names, addresses and contact details that may lead to the identification of individuals being removed.
Entities that the European Parliament referred to as passenger information units (PIUs) will be responsible for collecting, storing and processing the passenger data, for transferring it to the authorities and for exchanging it with the PIUs of other member states and with Europol, the European Union's law enforcement agency. The directive states that such transfers shall only be made "on a case-by-case basis" and exclusively for the specific purposes of "preventing, detecting, investigating or prosecuting terrorist offenses or serious crime."
The processing of personal data revealing a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation is explicitly prohibited.
Following the European Parliament's approval, the proposal must now be formally approved by the European Council. Once published in the EU Official Journal, member states will have two years to transpose it into their national laws. The directive will be reviewed two years after it is put into place in national laws.